No Login Data Private Local Save

Cross‑Origin Isolation Checker - Online COOP/COEP Test

8
0
0
0

Cross-Origin Isolation Checker

Verify COOP / COEP headers & browser cross-origin isolation status

Cross-Origin-Opener-Policy Cross-Origin-Embedder-Policy

Checking your browser...

Why does it matter?

Cross-origin isolation enables powerful features like SharedArrayBuffer, performance.measureUserAgentSpecificMemory(), and high-resolution timers. Without proper COOP/COEP headers, these APIs are blocked.

Check Any URL (curl command)

Enter a URL to generate a ready-to-use curl command that fetches Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy headers. Run it in your terminal.

Paste the command into your terminal. Look for the headers in the output.
How to Enable COOP

Add this HTTP response header to your top-level document:

Cross-Origin-Opener-Policy: same-origin

Possible values: unsafe-none, same-origin-allow-popups, same-origin

How to Enable COEP

Add this HTTP response header:

Cross-Origin-Embedder-Policy: require-corp

or credentialless (no CORP required for cross-origin resources).

Frequently Asked Questions

Cross-origin isolation is a browser security policy that restricts interactions with cross-origin documents and resources. It is enabled when both Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP) are set to specific values. This isolation unlocks powerful but potentially dangerous APIs like SharedArrayBuffer.

Open the developer console (F12) and type self.crossOriginIsolated. If it returns true, your page is isolated. You can also inspect the Network tab and look for the COOP/COEP headers or use this tool to generate a curl command.

To achieve full cross-origin isolation, you need:
  • Cross-Origin-Opener-Policy: same-origin
  • Cross-Origin-Embedder-Policy: require-corp (or credentialless)
Additionally, with require-corp, all cross-origin resources (images, scripts, etc.) must be loaded with Cross-Origin-Resource-Policy: cross-origin or serve appropriate CORS headers.

Cross-Origin-Opener-Policy (COOP) controls how a top-level document interacts with cross-origin windows. Setting it to same-origin isolates your browsing context from different origins, preventing cross-origin attacks via window.opener.

Cross-Origin-Embedder-Policy (COEP) prevents your document from loading any cross-origin resource that doesn’t explicitly grant permission (via CORP or CORS). The value require-corp enforces this, while credentialless allows loading cross-origin resources without credentials and without requiring CORP.

COOP isolates the top-level browsing context; COEP controls which resources can be embedded; Cross-Origin-Resource-Policy (CORP) tells the browser whether a resource can be loaded by another origin. All three work together to enforce cross-origin isolation.
🔧 Related Tools